Privacy Policy
This Privacy Policy informs about the processing of your Personal Data in connection with the CATchup website (https://www.puma-catchup.com) and its sub-pages of PUMA SE (hereinafter “PUMA”, “we” or “us”) in accordance with the EU General Data Protection Regulation (hereinafter “GDPR”).
1. Scope, Controller, Data Protection Officer and definitions
Scope of this Privacy PolicyThis Privacy Policy applies to direct visits of the CATchup website (https://www.puma-catchup.com) and its sub-pages via your web browser as well as the usage of the PUMA CATup app, which displays the content of the CATchup web pages specially prepared for mobile devices. It also applies to the use of push notifications that we send via the service provider OneSignal, Inc. (“OneSignal”) in our CATchup app and, where supported by your browser, as web push notifications on the CATchup website.
You can access, save and print out this data protection information at any time and free of charge on our websites under the link (https://www.puma-catchup.com/data-protection/).
Controller
Unless otherwise stated in this Privacy Policy, the responsible Controller for data processing within the scope of this Privacy Policy is:
PUMA SE
PUMA Way 1
91074 Herzogenaurach
Germany
E-Mail: dataprotection@puma.com
Contact details of Data Protection Officer
Please direct any questions regarding data protection to:
Datenschutzbeauftragter
PUMA SE
PUMA Way 1
91074 Herzogenaurach
E-Mail: dataprotection@puma.com
Definitions
This Privacy Policy is based on the following data protection terms, which we have defined for easier understanding:
GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Recipient means a natural or legal person, public authority, agency or another body, to which the Personal Data are disclosed, whether a third party or not. However, public authorities which may receive Personal Data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing. Recipients our for instance our third party service providers.
PUMA Group means all enterprises that are affiliated with PUMA Europe GmbH pursuant to Sec. 15 Aktiengesetz [German Stock Corporation Act].
Personal Data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; Personal Data is e.g. your name and contact data as well as other identifiers linked to you (e.g. IP addresses).
Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; PUMA SE is responsible for the data processing described in this Privacy Policy (see Sec. 1.).
Processing means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Processing includes, for example, the collection and use of your IP address to provide the website or the storage of a push token to deliver notifications.
2. Purposes, legal bases and, if applicable, data categories of processing your Personal Data
Processing of your data when you visit our websitesIf you access our web pages just to inform yourself about PUMA news without activating push notifications in the app or via web browser or otherwise actively transmitting information to us (purely informational usage), we process your Personal Data for the following purposes and on the basis of the following legal bases:
Processing for IT security purposes
When you visit our websites, we process your Personal Data, which is technically necessary for us to provide you with our websites and to ensure stability and security when you visit our websites. For this purpose we process the following Personal Data:
We process your Personal Data on the basis of our legitimate interest in ensuring IT security for you when you visit our websites (legal base: Art. 6 I 1 f) GDPR).
Analytics and marketing tracking
Google Tag Manager
On our websites, we use the Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
The Google Tag Manager enables PUMA to use so-called website tags via a web-based user interface provided to us by Google.
Website tags are “measurement codes and associated code fragments” that can communicate with Tag Manager servers and be configured through a web-based user interface, Google Tag Manager. Google Tag Manager also allows us to resolve other website tags that may also collect data.
In order to provide the service, we set a cookie if you have given consent to the activation of the cookie (Art. 6 para. 1, lit. a GDPR).
In the event that your personal data is transferred to Google LLC in the U.S., Google LLC has taken appropriate measures to ensure compliance with the level of data protection requirements applicable in the European Union or the European Economic Area (e.g. certification in the EU-U.S. Data Privacy Framework adopted by the EU Commission; conclusion of standard data protection clauses).
You can find more information about Google Tag Manager on the following Google web pages:
Google Analytics
We use Google Analytics on our websites, a web analysis service der Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland („Google“).
Google Analytics uses cookies (for more information about cookies please refer to our Cookie Policy) that enable an analysis of the use of our website. The information generated by the cookie about the use of our websites is usually transferred to a Google server in the USA and stored there. However, as we use Google Analytics with the extension “_anonymizeIP()”, Google will reduce the IP address of the website visitor within Member States of the European Union or in other states party to the Agreement on the European Economic Area beforehand. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of PUMA, Google will use this information to evaluate the use of the websites, to compile reports on website activities and to provide PUMA with further services associated with website and Internet use. The IP address transmitted by your browser within the scope of Google Analytics is not merged with other Google data.
Google Analytics is used in accordance with the conditions on which the German data protection authorities have agreed with Google.
Further information on terms of use and data protection can be found under:
https://business.safety.google/privacy/
https://policies.google.com/terms
https://policies.google.com/privacy
https://support.google.com/analytics/answer/9213390?hl=en
The described data processing is based on our legitimate interests to carry out analyses in order to improve our website and our products (legal base: Art. 6 I 1 f) GDPR).
You can give your consent to Google Analytics in our cookie banner. You can revoke this consent at any time with effect for the future by deactivating Google Analytics in our Cookies Settings.
If you do not give us your consent to analyze your data using Google Analytics, we will analyze the usage of our website without tracking your personal data with Google Consent Mode. You can find more information about Google Consent Mode in the corresponding passage of this Privacy Policy.
Google Consent Mode
If you do not give us your consent to analyze your data using Google Analytics, we will not track your personal data.
In these cases, we use the Google Consent Mode of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Consent Mode allows us to carry out an analysis using so-called modeling, which takes place without the use of cookies and without processing your personal data.
To carry out the so-called modeling, we process the following data without personal reference to your visit to our website: Function-related data (timestamp, user agent, referrer URL), aggregated data (Boolean information on the status of consent, random number when building each separate page, references to information on the ad click in the URL in the user’s navigation history of the previous or current page and information on the consent platform used).
Further information on Google Consent Mode can be found at:
https://support.google.com/google-ads/answer/10000067?hl=en
General information on data protection at Google can be found at the following links:
https://business.safety.google/privacy/
https://policies.google.com/privacy
Usage of cookies
When using our website, cookies are stored on your computer. Cookies are small text files that are assigned and stored on your hard disk to the browser you use. Cookies allow certain information to flow to the site that sets the cookie. This allows us to make our websites more user-friendly and effective.
In connection with push notifications, OneSignal may use cookies, local storage and service workers to remember your subscription status and enable delivery; details are provided in our Cookie Policy.
For more information about the use of cookies on our websites, the cookie categories and for individual settings please refer to our Cookies Policy, available under the following link: https://www.puma-catchup.com/cookie-policy/.
Links to social networks and share links
Our website contains hyperlinks that lead to pages of social networks (e.g., Facebook, Instagram, X/Twitter) or allow you to share content on those platforms.
No data is transmitted to the social networks before you click such a link. Only when you click a link is your browser redirected to the respective social network, and the respective provider becomes the controller for any processing of your data on its pages. Their privacy policies apply.
We may measure how often such links are clicked in order to improve our content. This is done without creating user profiles and without enabling us to identify individual users; the legal basis is our legitimate interests (Art. 6(1)(f) GDPR).
Push notifications (app & web)
Purpose & data categories. If you consent to receiving push notifications, we use OneSignal to deliver news and updates. For this purpose the following data may be processed:
Legal basis. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time (see Sec. 6). For purely technical delivery and security (e.g., fraud prevention, service availability), we rely on our legitimate interests (Art. 6(1)(f) GDPR).
How to manage/withdraw consent.
App: You can disable push notifications at any time in the app settings and/or your device’s notification settings.
Web push (browser): You can revoke permission in your browser’s site settings (Notifications).
Retention. We keep push subscription data only as long as your subscription is active and for a limited period thereafter for security and troubleshooting; interaction logs are retained in aggregated or pseudonymised form where possible.
No profiling/marketing beyond purpose. We do not use push notification data to build independent marketing profiles outside of the purposes stated above.
3. Retention and erasure of your Personal Data
We store your Personal Data for as long and to the extent required for the purposes named in this Privacy Policy (see section 2.).As soon as the data for the purposes named in section 2. is no longer required, we restrict the processing of that data and keep this restricted data only further for the length of the time in which you can assert claims against us, respectively we can claim them against you (i.e. the statutory period of limitations which is generally three years, starting with the end of the year in which the claim arises).
In addition, we store your Personal Data for as long as and insofar as we are legally obliged to do so. The German Commercial Code, the Fiscal Code and the Money Laundering Act, among others, impose corresponding duties of proof and retention. The retention period could be up to ten years.
4. Transfer of Personal Data and the categories of Recipients
We may transfer / disclose your Personal Data to the following categories of Recipients:IT service providers who provide the platforms, databases and tools for our services and provide analyses of user behavior on our websites.
For sending push notifications we use OneSignal, Inc., located at 201 S. B Street, San Mateo, CA 94401, USA as a processor. OneSignal processes the data listed in the corresponding section of this privacy policy on our behalf.
In addition, we transfer your Personal Data only and insofar as there is a legal obligation to do so (legal base: Art. 6 I 1 c) GDPR) (e.g. to the police authorities in the context of criminal investigations or to the data protection supervisory authorities).
5. Right to object to data processing based on legitimate interests
If we process your Personal Data on the basis of these legitimate interests (Art. 6 I 1 f) GDPR), you can object to the data processing at any time on grounds relating to his or her particular situation. We will comply with your objection, unless there are important reasons to the contrary within the meaning of Art. 21 GDPR. Please send your request to privacy@puma.com.If you object to the data processing, we process your Personal Data collected in this context to answer your inquiry. Your Personal Data will be processed in order to fulfil a legal obligation on (legal base: Art. 6 I 1 c) GDPR).
6. Right to withdraw consent
If you have given us your consent for the processing of your Personal Data, you can withdraw this consent at any time. The withdrawal of your consent is effective for the future and shall not affect the lawfulness of processing based on consent before its withdrawal. Please send your withdrawal of consent to dataprotection@puma.com. There may also be additional possibilities to withdraw consent (e.g., browser or device settings for push notifications).If you withdraw your consent, we process your Personal Data collected in this connection to answer your inquiry. Your Personal Data will be processed in order to fulfil a legal obligation (legal base: Art. 6 I 1 c) GDPR).
You can withdraw consent to push notifications at any time by using the controls described in the according section of this privacy policy. Upon withdrawal, we will cease push delivery and deactivate your push token.
7. Your other data protection rights
In accordance with the GDPR, you may demand at any time that we:provide you with information on your Personal Data that we process (Art. 15 GDPR), rectify any of your Personal Data (Art. 16 GDPR) erase (Art. 17 GDPR), restrict the processing (Art. 18 GDPR) and/or export (Art. 20 GDPR) your Personal Data.
Please send your request by email to privacy@puma.com or in writing, to PUMA SE, Data Protection, PUMA Way 1, 91074 Herzogenaurach, Deutschland.
If you exercise these rights against us, we will process Personal Data in order to respond to your request. In this regard, your Personal Data is processed to fulfil a legal obligation (legal base: Art. 6 I 1 c) GDPR).
Irrespective of the abovementioned rights, you can submit a complaint at a data protection supervisory authority, if you are of the opinion that the processing of your Personal Data by PUMA violates the GDPR (Art. 77 GDPR).
8. Changes to this Privacy Policy
The provisions of this privacy policy (which may be retrieved free-of-charge under https://www.puma-catchup.com/data-protection/), including the corresponding Cookie Policy (retrievable free-of-charge under https://www.puma-catchup.com/cookie-policy) apply in the version in force at the time our website is visited.We reserve the right to supplement and modify the content of this Privacy Policy. The updated Privacy Policy applies from the time in which it was published on our websites.
We will inform you promptly of these additions and modifications on our websites and, if we already have your contact information on file, will inform you via email or by post. You have the opportunity to inspect, print out and store the modified Privacy Policy at any time.